| Anyone running an e-comm site using php? 13:42 - Oct 21 with 880 views | giant_stow |
https://www.ncsc.gov.uk/news/c
My hosting company is mitigating this by banning 'add to cart' actions as a stop gap, but yours might be different - something to be aware off. |  |
| |  |
| Anyone running an e-comm site using php? on 13:57 - Oct 21 with 840 views | DanTheMan |
Oof, this must be nasty if they are warning ahead of the CVE release. Most I can find is remote code execution which is never a good sign... |  |
| |
| Anyone running an e-comm site using php? on 14:00 - Oct 21 with 821 views | giant_stow |
| Anyone running an e-comm site using php? on 13:57 - Oct 21 by DanTheMan |
Oof, this must be nasty if they are warning ahead of the CVE release. Most I can find is remote code execution which is never a good sign... |
I have limited understanding, but it seems like a global issue, on all php versions and yes, code insertions are mentioned as is the word 'emergency'.
My company said the official advice is to take sites down completely, but they're mitigating by in their own way for now. gulp. This could screw many many people up. | |
| |
| Anyone running an e-comm site using php? on 14:07 - Oct 21 with 800 views | Guthrum |
Was trying to work out if my website used php. A lot of the info online is very unclear.
However, I built it by hand using HTML & CSS, with nothing dynamic, so probably not. |  |
| |
| Anyone running an e-comm site using php? on 14:08 - Oct 21 with 798 views | giant_stow |
| Anyone running an e-comm site using php? on 14:07 - Oct 21 by Guthrum |
Was trying to work out if my website used php. A lot of the info online is very unclear.
However, I built it by hand using HTML & CSS, with nothing dynamic, so probably not. |
The web server might use it, but if your site is just static, you're probably good. | |
| |
| Anyone running an e-comm site using php? on 14:15 - Oct 21 with 786 views | Guthrum |
| Anyone running an e-comm site using php? on 14:08 - Oct 21 by giant_stow |
The web server might use it, but if your site is just static, you're probably good. |
Mostly just text-based genealogy stuff, with a few external links. | |
| |
| Anyone running an e-comm site using php? on 16:21 - Oct 21 with 639 views | MJallday |
| Anyone running an e-comm site using php? on 13:57 - Oct 21 by DanTheMan |
Oof, this must be nasty if they are warning ahead of the CVE release. Most I can find is remote code execution which is never a good sign... |
this has been floating around work today.
they seem to think its a gaping wide door into any systems. the bit they're forgetting is that a lot of other things need to have failed before you can exploit this one - and it will be patched pretty much instantly before any harm is done.
however ,the cyber n00bs are cr@pping their pants about it. i suppose it gives them something to do. |  |
| |
| Anyone running an e-comm site using php? on 16:26 - Oct 21 with 630 views | NthQldITFC |
| Anyone running an e-comm site using php? on 13:57 - Oct 21 by DanTheMan |
Oof, this must be nasty if they are warning ahead of the CVE release. Most I can find is remote code execution which is never a good sign... |
Guessing this is likely to be an exploit found by an AI 'powered' attack?
Glad I'm out of that game now, couldn't handle the responsibility. |  |
| |
| Anyone running an e-comm site using php? on 16:38 - Oct 21 with 606 views | DanTheMan |
| Anyone running an e-comm site using php? on 16:21 - Oct 21 by MJallday |
this has been floating around work today.
they seem to think its a gaping wide door into any systems. the bit they're forgetting is that a lot of other things need to have failed before you can exploit this one - and it will be patched pretty much instantly before any harm is done.
however ,the cyber n00bs are cr@pping their pants about it. i suppose it gives them something to do. |
Our SaaS HR software has taken their whole app offline...
We don't have any details yet do we? Or at least I've not seen anything official. | |
| |
Login to get fewer ads
| Anyone running an e-comm site using php? on 11:51 - Oct 23 with 335 views | BlueBlueBluex2 |
Been causing be headaches for the past 48hrs.
Had vendor calls, emergency change boards, patching left right and centre and mitigations put in place where we can’t patch immediately.
Nearly the weekend… |  | | |
| Anyone running an e-comm site using php? on 12:04 - Oct 23 with 314 views | DanTheMan |
| Anyone running an e-comm site using php? on 11:51 - Oct 23 by BlueBlueBluex2 |
Been causing be headaches for the past 48hrs.
Had vendor calls, emergency change boards, patching left right and centre and mitigations put in place where we can’t patch immediately.
Nearly the weekend… |
We've had a LOT of fun here as well. Albeit not php2shell related, but the eMudhra certificate scandal has been a right old pain.
And good to see eMudhra closing after what can only be described as impressive levels of incompetence. [Post edited 23 Oct 12:05]
| |
| |
| Anyone running an e-comm site using php? on 12:09 - Oct 23 with 304 views | giant_stow |
| Anyone running an e-comm site using php? on 12:04 - Oct 23 by DanTheMan |
We've had a LOT of fun here as well. Albeit not php2shell related, but the eMudhra certificate scandal has been a right old pain.
And good to see eMudhra closing after what can only be described as impressive levels of incompetence. [Post edited 23 Oct 12:05]
|
I have no idea what you guys are chatting about, but further down the techy chain, in hosting small wordpress sites land, loads of clients have shat their pants and emailed in panic. Don't blame them - its nice to have been able say my hosting company (I resell) had it patched at 4pm on the day. Reflected kudos for me! Well I spose I picked the right company at least! | |
| |
| Anyone running an e-comm site using php? on 12:37 - Oct 23 with 270 views | BlueBlueBluex2 |
| Anyone running an e-comm site using php? on 12:09 - Oct 23 by giant_stow |
I have no idea what you guys are chatting about, but further down the techy chain, in hosting small wordpress sites land, loads of clients have shat their pants and emailed in panic. Don't blame them - its nice to have been able say my hosting company (I resell) had it patched at 4pm on the day. Reflected kudos for me! Well I spose I picked the right company at least! |
I resell (and have my own) WP sites through Krystal as a side hustle and they were all over this yesterday morning and had patched by the time I had had my second tea of the day. | | | |
| Anyone running an e-comm site using php? on 12:38 - Oct 23 with 267 views | BlueBlueBluex2 |
| Anyone running an e-comm site using php? on 12:04 - Oct 23 by DanTheMan |
We've had a LOT of fun here as well. Albeit not php2shell related, but the eMudhra certificate scandal has been a right old pain.
And good to see eMudhra closing after what can only be described as impressive levels of incompetence. [Post edited 23 Oct 12:05]
|
I was not aware of this but have just scanned thorough a news article. That’s a different level of incompetence. | | | |
| Anyone running an e-comm site using php? on 13:12 - Oct 23 with 219 views | giant_stow |
| Anyone running an e-comm site using php? on 12:37 - Oct 23 by BlueBlueBluex2 |
I resell (and have my own) WP sites through Krystal as a side hustle and they were all over this yesterday morning and had patched by the time I had had my second tea of the day. |
I've heard good things about Krystal. I use a smallish company called Clook - very good on support. [Post edited 23 Oct 13:12]
| |
| |
| Anyone running an e-comm site using php? on 15:38 - Oct 23 with 127 views | stonojnr |
| Anyone running an e-comm site using php? on 14:07 - Oct 21 by Guthrum |
Was trying to work out if my website used php. A lot of the info online is very unclear.
However, I built it by hand using HTML & CSS, with nothing dynamic, so probably not. |
What do you mean trying to work out if it used php?. How do you build a website and not know what codebases you are using?
Because despite the media coverage, and some might say overreacting, in so far as this is just 2 vulnerabilities, they've missed the other 29 998 critical vulnerabilities reported this year alone some of which are ranked higher risks. Thats not to say these php vulnerabilities arent important to fix.
But how do you know your website wasn't equally at risk to any of those ?
Did you check for Log4Shell, Heartbleed risks too back in the day ?
And its not just ecommerce ok, the php2shell can compromise a WordPress site even if its just a blog or a landing page because everything on WordPress is coded in php. That applies to any code using php not just eshopping | | | |
| Anyone running an e-comm site using php? on 16:04 - Oct 23 with 111 views | DanTheMan |
| Anyone running an e-comm site using php? on 15:38 - Oct 23 by stonojnr |
What do you mean trying to work out if it used php?. How do you build a website and not know what codebases you are using?
Because despite the media coverage, and some might say overreacting, in so far as this is just 2 vulnerabilities, they've missed the other 29 998 critical vulnerabilities reported this year alone some of which are ranked higher risks. Thats not to say these php vulnerabilities arent important to fix.
But how do you know your website wasn't equally at risk to any of those ?
Did you check for Log4Shell, Heartbleed risks too back in the day ?
And its not just ecommerce ok, the php2shell can compromise a WordPress site even if its just a blog or a landing page because everything on WordPress is coded in php. That applies to any code using php not just eshopping |
Lots of people will host small websites on providers and not know or understand what hosting technology underpins the backend. | |
| |
| |
By continuing to use the site, you agree to our use of cookies and to abide by our Terms and Conditions.
